Pocket-id vulnerabilities
We track 4 vulnerabilities in Pocket-id products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 4, 2026.
Latest Pocket-id vulnerabilities
- 7.7 High severity
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services.
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidc_service.go accepts the client-controlled resource parameter and embeds
- 9.6 Critical severity
pocket-id: Insufficient Verification of Data Authenticity
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/email_verification_token.go to bind an email-verification token only
- 8.1 High severity
pocket-id: Improper Authorization
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.6.0, The createTokenFromRefreshToken function (oidc_service.go) validates the refresh token's cryptographic integrity but does not re-validate the
- 7.1 High severity
pocket-id: Incorrect Authorization
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client